NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW-1] IP proto 50 (ESP) / routing - ESP traffic ignores routing table



Thanks Carlos,

Hope this makes it clearer:

                        __ce-rtr1__internal WAN__other vpn-1 gateways
                       /
                      /
192.168.25.0 -- A ---+---- B --- 192.168.24.0
                  \
                   \___ce-rtr2__ internet __ other vpn-1 gateways


Gateway A is running VPN-1,
its encryption domain is 192.168.25.0,
its internal interface 192.168.25.1,
its first external interface connects to a customer edge router to Internet
(ce-rtr2).
It has its default gateway defined to that router.
its second external interface connects to a subnet in which Gateway B
and another customer edge router that connects to an internal WAN.

Gateway B is running VPN-1
its encryption domain is 192.168.24.0,
its internal interface is 192.168.24.1
its external interface connects to Gateway A and ce-rtr1

When i try to set up an IPSec tunnel between Gateway A and Gateway B,
I see that the ESP traffic from Gateway A leaves the wrong interface to
ce-rtr2 and that
the ESP traffic from Gateway B goes to ce-rtr1. This is because the default
gateway for A is ce-rtr2 and for B it is ce-rtr1.

While all other traffic behaves conform the routing tables, the ESP traffic
always is directed to the default gateway, even if I manually define static
routes.


Hans Bayle
Network Consultant
[email protected]


-----Original Message-----
From: Mailing list for discussion of Firewall-1
[mailto:[email protected]]On Behalf Of Carlos
Santos
Sent: Thursday, August 14, 2003 5:09 PM
To: [email protected]
Subject: Re: [FW-1] IP proto 50 (ESP) / routing - ESP traffic ignores
routing table


If you mind me asking...what are you routing?
IP address of the gateway?
IP addresses of the encryption domain behind the other peer?


CS
>-----Original Message-----
>From: Mailing list for discussion of Firewall-1
>[mailto:[email protected]] On Behalf
>Of Hans Bayle
>Sent: Thursday, 14 August, 2003 15:38
>To: [email protected]
>Subject: [FW-1] IP proto 50 (ESP) / routing - ESP traffic
>ignores routing table
>
>
>>>7890
>
>Hi,
>
>
>We are using NG FP3 on Solaris 9.
>
>On our VPN gateway with 2 external interfaces; one interface connected
>to Internet, the other to an internal WAN, ESP traffic ignores
>the routing
>table, and always flows to the default gateway (a router to Internet),
>and not to another VPN gateway that is connected to the internal WAN.
>
>Within the same configuration, management traffic, TCP traffic
>etc. *does*
>follow
>the routing table.
>
>What can I do to let ESP traffic follow the routing table?
>
>
>Hans Bayle
>Network Consultant
>[email protected]
>
>=================================================
>To set vacation, Out-Of-Office, or away messages,
>send an email to [email protected]
>in the BODY of the email add:
>set fw-1-mailinglist nomail
>=================================================
>To unsubscribe from this mailing list,
>please see the instructions at
>http://www.checkpoint.com/services/mailing.html
>=================================================
>If you have any questions on how to change your
>subscription options, email
>[email protected]
>=================================================
>


Trusted Systems - http://www.trusted.pt
Praga de Alvalade, n.: 6 - 6.: piso
1700-036 Lisboa, PORTUGAL
Tel: +00
Fax: +42

--

A presente mensagem pode conter informagco considerada confidencial.
Se o receptor desta mensagem nco for o destinatario indicado, fica
expressamente proibido de copiar ou enderegar a mensagem a terceiros.
Em tal situagco, o receptor devera destruir a presente mensagem e por
gentileza informar o emissor de tal facto.

Privileged or confidential information may be contained in this
message. If you are not the addressee indicated in this message, you
may not copy or deliver this message to anyone. In such case, you
should destroy this message and kindly notify the sender by reply
email.

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================

=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [email protected]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[email protected]
=================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.